Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Worm:Win32/Phorpiex.B Entfernen (https://www.trojaner-board.de/132156-worm-win32-phorpiex-b-entfernen.html)

Jakobens 12.03.2013 22:53
Worm:Win32/Phorpiex.B Entfernen
 
Hallo, ich habe mich im web schon ein wenig schlau gemacht... dieser wurm wird auch Facebook trojaner genannt. ich habe dort gelesen dass die vorgeschlagen haben den Computer zu formatieren. dass sollte aber erst der allerletzte ausweg sein.
Bekommen habe ich diesen Wurm durch Skype... jemand hat mir bilder geschickt und geschrieben
wie findest du das foto? hxxp://www.goo.gl/EcCSG?skype_image=IMG*****.JPG
:D
hab ich dir das foto schon gezeigt? hxxp://www.goo.gl/EcCSG?skype_image=IMG*****.JPG

Bitte Diese Links auf keinen fall versuchen zu öffnen, ich habe mit absicht, anstatt zahlen, sterne eingefügt. Trotz unbrauchbarkeit schreib ich diese warnung

und jetzt schickt der von meinem namen aus an alle in meiner kontaktliste diese zwei nachrichten.

Ich habe Avira durchlaufen lassen aber der hat nichts gefunden
Ich ließ Spybot Search & destroy durchsuchen... aber fehlschlag
Ich startete Ccleaner aber ohne erfolg

Am nächsten tag bemerkte der Windows Defender den wurm (Phorpiex.B) und somit habe ich anhaltspunkte. Nur weiß ich immer noch nicht wi ich den loswerde.
Angeblich soll er ja in quarantäne verschoben sein aber ich traue im moment keinem programm.

Um voranzukommen habe ich mir OTL geladen und gestartet nach anweisungen von dieser seite. Ich habe die Textseiten kopiert und schreibe sie unter diesen beitrag.
ich hoffe es kann mir jemand helfen den zu entfernen.

Ich bedanke mich schonmal im voraus alleine fürs gedanken machen ;)

OTL.txtOTL Logfile:
Code:
OTL logfile created on: 12.03.2013 19:25:14 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\****\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19400)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 40,23% Memory free
4,22 Gb Paging File | 2,43 Gb Available in Paging File | 57,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 143,42 Gb Total Space | 14,56 Gb Free Space | 10,15% Space Free | Partition Type: NTFS
 
Computer Name: ****-PC | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\****\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_6_602_171.exe (Adobe Systems, Inc.)
PRC - C:\Users\****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Lenovo\Camera Center\bin\LenovoCameraCenter.exe (Lenovo)
PRC - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)
PRC - C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Lenovo)
PRC - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo)
PRC - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo)
PRC - C:\Program Files\Lenovo\HOTKEY\FnF5svc.exe (Lenovo.)
PRC - C:\Windows\BisonCam\BsMnt.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Lenovo\PM Driver\PMSveH.exe (Lenovo)
PRC - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe ()
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Windows\System32\IPSSVC.EXE (Lenovo Group Limited)
PRC - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe ()
PRC - C:\Program Files\Common Files\Lenovo\Logger\logmon.exe ()
PRC - C:\Windows\vsnp2uvc.exe (Sonix)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\e64304962098e90f0d3f4c33c1b080a6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\004bc6615f9c06df5c98859d35149fe6\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b757806657fa5db2b1ed1a89b026b463\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files\Lenovo\Camera Center\bin\CameraApplicationLaunchPadLibrary.dll ()
MOD - C:\Program Files\Lenovo\Camera Center\bin\CameraApplicationLaunchPadDataObjects.dll ()
MOD - C:\Program Files\Lenovo\Camera Center\bin\de\LocalizationWrapper.resources.dll ()
MOD - C:\Program Files\Lenovo\Camera Center\bin\LocalizationWrapper.dll ()
MOD - C:\Program Files\Common Files\Lenovo\CDRecord.dll ()
MOD - C:\Windows\BisonCam\BsMnt.exe ()
 
 
========== Services (SafeList) ==========
 
SRV - (SBSDWSCService) -- C:\Program Files\Spybot File not found
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (SUService) -- C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ThinkVantage Registry Monitor Service) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited)
SRV - (AcSvc) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo)
SRV - (AcPrfMgrSvc) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo)
SRV - (FNF5SVC) -- C:\Program Files\Lenovo\HOTKEY\FnF5svc.exe (Lenovo.)
SRV - (PMSveH) -- C:\Program Files\Lenovo\PM Driver\PMSveH.exe (Lenovo)
SRV - (nmservice) -- C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe (Pure Networks, Inc.)
SRV - (nmraapache) -- C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe (Pure Networks, Inc.)
SRV - (TPHKSVC) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe ()
SRV - (IAANTMON) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (IPSSVC) -- C:\Windows\System32\IPSSVC.EXE (Lenovo Group Limited)
SRV - (TVT Backup Protection Service) -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (teamviewervpn) -- C:\Windows\System32\drivers\teamviewervpn.sys (TeamViewer GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (ATSWPDRV) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (TVTI2C) -- C:\Windows\System32\drivers\tvti2c.sys (Lenovo (United States) Inc.)
DRV - (psadd) -- C:\Windows\System32\drivers\psadd.sys (Lenovo (United States) Inc.)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (NETw3v32) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (LPCFilter) -- C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (PROCDD) -- C:\Windows\System32\drivers\PROCDD.SYS (Lenovo Group Limited)
DRV - (lenovo.smi) -- C:\Windows\System32\drivers\smiif32.sys (Lenovo Group Limited)
DRV - (ASPI) -- C:\Windows\System32\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.live.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{A08E5916-933F-4D33-BC5A-EC5D3D3ED3FD}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=LENIE
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/3000notebook [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKCU\..\SearchScopes\{A08E5916-933F-4D33-BC5A-EC5D3D3ED3FD}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=LENIE
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: maltegoetz%40proxtube.com:1.1.35
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.08 18:31:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.03.08 18:31:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.03.29 12:38:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Extensions
[2013.02.28 17:48:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\dzthdd6z.default\extensions
[2013.02.28 17:48:30 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\dzthdd6z.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013.01.29 13:22:36 | 000,000,000 | ---D | M] (Wörterbuch Deutsch (de-DE), Hunspell-unterstützt) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\dzthdd6z.default\extensions\de_DE@dicts.j3e.de
[2012.11.12 20:33:39 | 000,000,000 | ---D | M] (ProxTube) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\dzthdd6z.default\extensions\maltegoetz@proxtube.com
[2013.02.14 16:23:05 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\dzthdd6z.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.03.08 18:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013.03.08 18:31:40 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.03.08 18:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2013.03.08 18:31:49 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.21 20:51:51 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.12 20:26:32 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.21 20:51:51 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.21 20:51:51 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.21 20:51:51 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.21 20:51:51 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.04.29 16:50:28 | 000,433,231 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 14912 more lines...
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ProxTube) - {0AA2810A-F009-4BD7-A10A-32F140A1B9F3} - C:\Users\****\AppData\LocalLow\ProxTube\IE\ProxTube.dll (Malte Goetz)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (CPwmIEBrowserHelper Object) - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BsMnt] C:\Windows\BisonCam\BsMnt.exe ()
O4 - HKLM..\Run: [CameraApplicationLauncher] C:\Program Files\Lenovo\Camera Center\bin\CameraApplicationLaunchPadLauncher.exe ()
O4 - HKLM..\Run: [FingerPrintSoftware] C:\Program Files\Lenovo Fingerprint Software\fpapp.exe (Authentec,Inc)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Microsoft Windows Manager] C:\Users\****\S-80-5421-8975-4765\winmgr.exe ()
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Windows Live Search - c:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5B3B59F0-4923-4290-8681-BADB4E303780}: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FB81930C-0B28-409F-A7BB-609B033EF23A}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\puresp3.dll (Pure Networks, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{44586316-f0e7-11e1-894c-001e4cd75bfe}\Shell - "" = AutoRun
O33 - MountPoints2\{44586316-f0e7-11e1-894c-001e4cd75bfe}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{4458631a-f0e7-11e1-894c-001e4cd75bfe}\Shell - "" = AutoRun
O33 - MountPoints2\{4458631a-f0e7-11e1-894c-001e4cd75bfe}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{750a4930-96d4-11e0-a351-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{750a4930-96d4-11e0-a351-001b380e7ab8}\Shell\AutoRun\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{750a4932-96d4-11e0-a351-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{750a4932-96d4-11e0-a351-001b380e7ab8}\Shell\AutoRun\command - "" = H:\SETUP.EXE
O33 - MountPoints2\{750a493b-96d4-11e0-a351-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{750a493b-96d4-11e0-a351-001b380e7ab8}\Shell\AutoRun\command - "" = I:\SETUP.EXE
O33 - MountPoints2\{7e9f3bc3-f5cd-11e0-acdb-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{7e9f3bc3-f5cd-11e0-acdb-001b380e7ab8}\Shell\AutoRun\command - "" = E:\setup.exe
O33 - MountPoints2\{d02a51b5-9bfd-11e0-a350-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{d02a51b5-9bfd-11e0-a350-001b380e7ab8}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{d02a51b5-9bfd-11e0-a350-001b380e7ab8}\Shell\directx\command - "" = E:\DirectX9\dxsetup.exe
O33 - MountPoints2\{d02a51b5-9bfd-11e0-a350-001b380e7ab8}\Shell\setup\command - "" = E:\setup.exe
O33 - MountPoints2\{d02a51bb-9bfd-11e0-a350-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{d02a51bb-9bfd-11e0-a350-001b380e7ab8}\Shell\AutoRun\command - "" = F:\CDCheck.exe
O33 - MountPoints2\{d02a51bf-9bfd-11e0-a350-001b380e7ab8}\Shell - "" = AutoRun
O33 - MountPoints2\{d02a51bf-9bfd-11e0-a350-001b380e7ab8}\Shell\AutoRun\command - "" = G:\CDCheck.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.11 20:07:54 | 000,000,000 | RHSD | C] -- C:\Users\****\S-80-5421-8975-4765
[2013.03.08 18:31:39 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.18 17:10:52 | 002,048,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.02.18 17:10:50 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.02.18 17:10:37 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2013.02.18 17:10:36 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.02.18 17:10:36 | 000,630,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.02.18 17:10:35 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2013.02.18 17:10:35 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2013.02.18 17:10:35 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2013.02.18 17:10:35 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.02.18 17:10:34 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2013.02.18 17:10:34 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.02.18 17:10:34 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2013.02.18 17:10:34 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.02.18 17:10:34 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2013.02.18 17:10:34 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2013.02.18 17:10:34 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2013.02.18 17:10:34 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2013.02.18 17:10:33 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.02.18 17:10:33 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.02.18 17:10:33 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2013.02.18 17:03:43 | 003,602,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.02.18 17:03:43 | 003,550,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.02.11 17:31:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.11 17:31:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.12 19:26:50 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7FB51E8E-F57E-4D8A-916A-1207E2509139}.job
[2013.03.12 19:12:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.12 18:59:00 | 000,000,252 | ---- | M] () -- C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2013.03.12 18:08:15 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.12 18:08:15 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.12 16:59:34 | 000,027,240 | ---- | M] () -- C:\Users\****\AppData\Roaming\nvModes.001
[2013.03.12 16:09:14 | 000,000,000 | -H-- | M] () -- C:\Users\****\AppData\Roaming\winsvcns.sys
[2013.03.12 16:09:03 | 000,025,269 | ---- | M] () -- C:\Windows\System32\PROCDB.INI
[2013.03.12 16:08:22 | 000,000,380 | ---- | M] () -- C:\Windows\System32\IPSCtrl.INI
[2013.03.12 16:08:18 | 000,257,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.03.12 16:08:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.11 21:13:28 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.03.10 16:33:53 | 000,000,000 | ---- | M] () -- C:\Users\Public\Documents\AcSvc.dmp
[2013.03.07 16:26:13 | 000,050,176 | ---- | M] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.03.07 16:25:02 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.03.07 16:25:02 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.03.07 16:25:02 | 000,122,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.03.07 16:25:02 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.03.07 14:58:36 | 000,009,192 | ---- | M] () -- C:\Users\****\Documents\2. Mose 14, 5-31.pdf
[2013.03.01 16:44:08 | 000,027,240 | ---- | M] () -- C:\Users\****\AppData\Roaming\nvModes.dat
[2013.02.27 11:12:42 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.02.27 11:12:42 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.02.21 21:10:08 | 000,083,229 | ---- | M] () -- C:\Users\****\Documents\Römer 8,18-26.pdf
[2013.02.18 21:53:46 | 000,000,774 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.02.18 16:33:41 | 000,001,732 | ---- | M] () -- C:\tvtpktfilter.dat
[2013.02.11 17:31:43 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
 
========== Files Created - No Company Name ==========
 
[2013.03.12 16:08:03 | 000,257,080 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.03.11 20:08:06 | 000,000,000 | -H-- | C] () -- C:\Users\****\AppData\Roaming\winsvcns.sys
[2013.03.07 16:24:11 | 001,575,381 | ---- | C] () -- C:\Users\****\Desktop\P1070973.JPG
[2013.03.07 14:58:36 | 000,009,192 | ---- | C] () -- C:\Users\****\Documents\2. Mose 14, 5-31.pdf
[2013.02.21 21:10:08 | 000,083,229 | ---- | C] () -- C:\Users\****\Documents\Römer 8,18-26.pdf
[2013.02.18 16:33:41 | 000,001,732 | ---- | C] () -- C:\tvtpktfilter.dat
[2011.08.28 16:01:36 | 000,000,001 | ---- | C] () -- C:\Windows\System32\SI.bin
[2011.08.10 13:54:28 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2011.06.21 12:23:16 | 000,025,773 | ---- | C] () -- C:\Users\****\AppData\Roaming\UserTile.png
[2011.06.15 00:49:20 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2011.06.15 00:49:20 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2011.06.15 00:49:20 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2011.04.01 18:49:14 | 000,050,176 | ---- | C] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.31 20:47:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.03.31 20:47:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.03.31 20:46:32 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.03.31 20:46:11 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.03.31 17:05:35 | 000,027,240 | ---- | C] () -- C:\Users\****\AppData\Roaming\nvModes.001
[2011.03.31 15:27:29 | 000,027,240 | ---- | C] () -- C:\Users\****\AppData\Roaming\nvModes.dat
[2011.03.29 19:51:52 | 000,618,442 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.03.29 19:51:52 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.03.29 19:51:52 | 000,122,648 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.03.29 19:51:52 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2011.03.29 13:30:05 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.03.29 11:46:40 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2011.03.29 11:36:40 | 000,001,356 | ---- | C] () -- C:\Users\****\AppData\Local\d3d9caps.dat
[2011.03.29 10:36:01 | 002,115,816 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2011.03.29 10:28:31 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
[2011.03.29 10:26:58 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2011.03.29 10:24:00 | 009,598,080 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2011.03.29 10:24:00 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2011.03.29 10:23:59 | 000,167,936 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2011.03.29 10:23:59 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:18 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:9C504A4D
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:8DCF53BE

< End of report >
--- --- ---

Extras.txtOTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 12.03.2013 19:25:14 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\****\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19400)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,80 Gb Available Physical Memory | 40,23% Memory free
4,22 Gb Paging File | 2,43 Gb Available in Paging File | 57,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 143,42 Gb Total Space | 14,56 Gb Free Space | 10,15% Space Free | Partition Type: NTFS
 
Computer Name: ****-PC | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08365FFE-74FD-487A-908D-F5C9BF2203FC}" = lport=57673 | protocol=6 | dir=in | name=pando media booster |
"{1574800A-4DBF-4301-B757-F14A3D7A4EAE}" = lport=139 | protocol=6 | dir=in | app=system |
"{216AC32B-03B1-4BAD-8BC8-261C14AFE5AE}" = lport=57673 | protocol=6 | dir=in | name=pando media booster |
"{268492E7-F35E-4D0F-824B-687621F6C696}" = lport=138 | protocol=17 | dir=in | app=system |
"{32EAA8D8-7806-45CA-952B-62B2CC65292E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3F815AD8-4C21-44D2-9D01-41D542858938}" = rport=139 | protocol=6 | dir=out | app=system |
"{47DBC7FE-1421-4A5E-88DE-83B0ADC8C123}" = lport=445 | protocol=6 | dir=in | app=system |
"{4ED37AE3-489F-41B2-B49B-96E447247EC1}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{53090EC9-0886-4B4D-B71A-0B6A7ED29D08}" = lport=57673 | protocol=17 | dir=in | name=pando media booster |
"{579820E8-B601-45DF-8C14-589867D478BD}" = rport=445 | protocol=6 | dir=out | app=system |
"{6A515343-386D-426B-A0FC-F00130411DE2}" = rport=138 | protocol=17 | dir=out | app=system |
"{6B0A1B52-81D0-4525-AF1F-15ED1898A3F0}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{75CCB7F3-9AC4-42B0-BF78-31A41247584B}" = rport=137 | protocol=17 | dir=out | app=system |
"{8907F23C-6BA9-471C-830B-9038C0739ADA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8B913F8E-C641-456F-8A6B-E064F3E53D12}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8D574578-8741-4823-8F77-090E402E53EA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{ABDE6016-74D5-41D3-A6D6-5B79E55CAD45}" = lport=57673 | protocol=17 | dir=in | name=pando media booster |
"{C16445AF-2D4F-401A-B646-6696AE4978F0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CEE1C008-E662-4F9A-AEE6-B4E14B695006}" = lport=137 | protocol=17 | dir=in | app=system |
"{D840E650-E277-4717-A41B-8E746DA5BBBA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F4EDE2E7-7A1C-42CE-9365-9D8DB1F257E1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F8ACFBA6-DFA2-493A-80F2-551BF0B70E53}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1A0C85D4-9F30-42E9-840E-1090A6BED89D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1EE542D1-9EBE-4DF4-846D-6CCA8A72022A}" = protocol=17 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe |
"{29326E74-4C58-4359-A9CA-8DCF4F29FF48}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{3F731D8D-96B3-4308-B3F5-4AB9C2564B7B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{4B8644E6-CCAA-4C17-B3A4-7546F356DDF7}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{52833BEF-CAA0-4B9D-A826-91A90B931870}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{5B6A7F3B-14BF-4821-8654-F54FC36E15E5}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{6287C7F1-E094-4FB8-8E71-8616B2B1028F}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{63994EDA-6BE5-4CC4-89BB-478CA9AD4B3E}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{7401E351-A88C-4387-A0BA-1ABF18459B8A}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{8462DCF5-5C66-4463-A382-A821599D1DD5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{8A660C0C-DF9C-455E-8A69-DFAEA7AE357E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8B27EBED-C7C9-4BEF-9704-E27D8C472636}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{A5D73E4F-8B10-4D22-A7AF-76D0C3739DC5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{CA61B84B-06F5-444A-9369-9FE37F65D3E6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CB75D1A1-7F91-41BD-AF14-1E6DD5BF095F}" = protocol=6 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe |
"{E344D16F-E4C2-47B0-8473-04F9D71D9EFE}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"TCP Query User{0E156968-FCCA-4062-8C80-F33A40F33211}C:\windows\system32\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dpnsvr.exe |
"TCP Query User{59D9E6DC-5219-40FE-8460-8533108C3800}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{7281D6A3-B4DB-4885-8E90-C2248688C3E6}C:\users\****\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{17651EF6-EB38-46D3-A479-86E17C1F629E}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"UDP Query User{84E4E54A-A319-4CA4-9AF7-F82E54254318}C:\windows\system32\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dpnsvr.exe |
"UDP Query User{B1737BE8-345F-41E7-B92C-D61B756D7F47}C:\users\****\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\****\appdata\roaming\dropbox\bin\dropbox.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0F4EFCE8-E358-4430-A504-F55F32BA1816}" = Client Security Solution
"{10DDCDDD-9A59-4496-9371-C17F1668D433}" = Windows Live Toolbar
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{39690898-1226-4455-9D76-A6CAF97BD485}_is1" = MyBible 1.5.3
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Camera
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = Integrated Camera
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.33
"{62715632-A555-4D9E-9CEC-4F84EB55B07B}" = PM Driver
"{6280149E-EFF3-4F1B-BD43-5B7EDD6F620A}" = Ergänzung zu Lenovo Care
"{668ACF05-E455-4932-A2D2-5822A8206FEB}" = Camera Center
"{786547F9-59BB-4FA3-B2D8-327FF1F14870}" = Adobe Flash Player 9 ActiveX
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E4C16B8-8F76-4940-8505-98E93C00BF19}" = Rescue and Recovery
"{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections
"{800C6CC9-8EEB-4A6A-ABD4-C05EAE279606}" = Network Magic
"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A52A504E-18BE-4821-9A2A-BFB4542DA0BD}" = Lenovo PM Driver
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{B1F625EB-9691-4889-A864-DA085739F3F0}" = Power Ux Customization
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF52099A-3BEA-4C41-AEA8-1E190F04D737}" = Lenovo Care
"{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}" = Broadcom Gigabit Integrated Controller
"{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center
"{EC422FB2-9F4D-4FB1-A5CE-5F741132EBC5}" = Lenovo Fingerprint Software
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"AwayTask" = Maintenance Manager
"CCleaner" = CCleaner
"DEUTSCHLAND SPIELT Spiele Post" = DEUTSCHLAND SPIELT Spiele Post
"DSGPlayer" = DEUTSCHLAND SPIELT GAME CENTER
"InstallShield_{62715632-A555-4D9E-9CEC-4F84EB55B07B}" = PM Driver
"Lenovo Registration" = Lenovo Registration
"LENOVO.SMIIF" = Lenovo System Interface Driver
"Luxor 5th Passage" = Luxor 5th Passage
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"OnScreenDisplay" = Anzeige am Bildschirm
"PC-Doctor 5 for Windows" = PC-Doctor 5 für Windows
"Picasa 3" = Picasa 3
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 7" = TeamViewer 7
"USBPMon" = Registry patch for Windows Vista USB S3 PM Enablement
"Windows Live Toolbar" = Windows Live Toolbar
"YTdetect" = Yahoo! Detect
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.11.2012 15:33:42 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung flash-downloader.exe, Version 1.1.0.0, Zeitstempel
 0x505b25fa, fehlerhaftes Modul flash-downloader.exe, Version 1.1.0.0, Zeitstempel
 0x505b25fa, Ausnahmecode 0xc0000005, Fehleroffset 0x0001d80b,  Prozess-ID 0xf94,
Anwendungsstartzeit 01cdc1099b317eba.
 
Error - 14.12.2012 16:42:43 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung cmd.exe, Version 6.0.6001.18000, Zeitstempel
 0x47918bde, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.18541, Zeitstempel
 0x4ec3e3d5, Ausnahmecode 0xc0000142, Fehleroffset 0x00009f5d,  Prozess-ID 0xf00,
Anwendungsstartzeit 01cdda3b90958577.
 
Error - 21.12.2012 14:23:35 | Computer Name = ****-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 01.01.2013 06:47:09 | Computer Name = ****-PC | Source = Microsoft-Windows-RestartManager | ID = 10007
Description =
 
Error - 03.03.2013 10:14:10 | Computer Name = ****-PC | Source = VSS | ID = 12289
Description =
 
Error - 11.03.2013 15:10:33 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung 5401455964.exe, Version 3.3.8.1, Zeitstempel
 0x513ded0e, fehlerhaftes Modul 5401455964.exe, Version 3.3.8.1, Zeitstempel 0x513ded0e,
 Ausnahmecode 0x40000015, Fehleroffset 0x0000a6a7,  Prozess-ID 0x16e4, Anwendungsstartzeit
 01ce1e8c03af6c17.
 
Error - 11.03.2013 15:12:21 | Computer Name = ****-PC | Source = VSS | ID = 8194
Description =
 
Error - 12.03.2013 11:11:56 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung 1122924741.exe, Version 3.3.8.1, Zeitstempel
 0x513f2e3e, fehlerhaftes Modul 1122924741.exe, Version 3.3.8.1, Zeitstempel 0x513f2e3e,
 Ausnahmecode 0x40000015, Fehleroffset 0x0000a6a7,  Prozess-ID 0x11dc, Anwendungsstartzeit
 01ce1f33b211b277.
 
Error - 12.03.2013 11:32:46 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung 4237870585.exe, Version 3.3.8.1, Zeitstempel
 0x513f2e3e, fehlerhaftes Modul 4237870585.exe, Version 3.3.8.1, Zeitstempel 0x513f2e3e,
 Ausnahmecode 0x40000015, Fehleroffset 0x0000a6a7,  Prozess-ID 0x1280, Anwendungsstartzeit
 01ce1f36931e5be7.
 
Error - 12.03.2013 11:34:55 | Computer Name = ****-PC | Source = VSS | ID = 8194
Description =
 
[ System Events ]
Error - 11.03.2013 11:21:37 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 11.03.2013 11:25:58 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 11.03.2013 11:26:34 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 11.03.2013 11:27:04 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 11.03.2013 11:27:34 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 12.03.2013 11:08:45 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 12.03.2013 11:12:31 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 12.03.2013 11:13:01 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 12.03.2013 11:13:39 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 12.03.2013 11:14:11 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7011
Description =
 
 
< End of report >
--- --- ---

cosinus 13.03.2013 14:41
Hallo und :hallo:

Zitat:
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Warum bitte eine Business Edition für Windows? Wer braucht das als Heimanwender?
Ist das rein zufällig ein Büro-/Firmen-PC? Oder ein Uni-Rechner?

Jakobens 13.03.2013 23:49
Ich habe den laptop so gekauft... Er war ganz neu und der Key steht auf der rückseite des laptops... ich war mir dessen nicht mal bewusst welche version ich habe weil ich mich nicht näher informiert habe.
Damit will ich sagen ich benutze diesen laptop auschlieslich Privat.
Dass es eine andere windows version ist... ist zufall.

cosinus 14.03.2013 15:25
Ok, danke für die Erklärung, wahrscheinlich hast du dir ein Gerät aus der Business-Line geholt, bei dem dann auch gleich eine dafür passendere Edition von Vista mit inkl war


Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Rootkitscan mit GMER

Bitte lade dir GMER Rootkit Scanner GMER herunter: (Dateiname zufällig)
  • Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
  • Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei: IAT/EAT und Show All
  • Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
  • Starte den Scan mit "Scan".
  • Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!


Tauchen Probleme auf?
  • Probiere alternativ den abgesicherten Modus.
  • Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.


Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Jakobens 16.03.2013 19:30
Vielen Dank für deine Zeit... ich habe von jemand anderem der dass selbe problem hatte sagen lassen malwarebytes mal durchlaufen zu lassen... Es tut mir schrecklich leid dass du dir soviel arbeit mit meinem Problem gemacht hast... Doch ich habe malwarebytes einfach durchlaufen lassen... falls ich ein (so klein es auch sein mag) anzeichen finde dass der noch/wieder da ist dann komme ich auf den thread zurück.
Danke nochmal für den Aufwand.
übrigens hast du alles sehr detalliert beschrieben da kann ich ich nachhinein schritt für schritt alles durchgehen.... ich hoffe dieser thread und dein lösungsvorschlag helfen noch vielen mehr.

cosinus 17.03.2013 02:52
Ok, aber eine Bitte: lass solche Zwischenrufe, poste nur wenn es Probleme gibt oder wenn du die Logs hast (diese dann auch posten in CODE-Tags)


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:31 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19